Legal Notice and Data Protection Policy

Website publisher (LCEN legal notices)

In accordance with Article 6 III of Law No. 2004-575 of June 21, 2004 on Confidence in the Digital Economy (LCEN), the following information is provided to users:

For any questions relating to the website or data protection, you may contact us at the address below.

Purposes of processing

Personal data collected is used for the following purposes, each associated with its respective legal basis (see Legal bases section):

• User account creation and management (contractual performance)
• Authentication and access security (contractual performance)
• Provision and improvement of cybersecurity tools (contractual performance)
• Technical support and responding to requests (contractual performance)
• Newsletter sending (consent)
• Connection logging and service security (legitimate interest)
• Compliance with legal and accounting obligations (legal obligation)

No personal data is sold, rented, or transferred to third parties for commercial purposes.

Collected data

We collect only the data that is strictly necessary for the operation of the service. Some data is mandatory to access the service (email, password); other data is optional.

Legal bases

In accordance with Article 6 of the GDPR, each processing activity relies on a specific legal basis:

• Article 6.1.b -- Contractual performance: account creation, service provision, technical support
• Article 6.1.a -- Consent: newsletter sending, non-essential cookie placement
• Article 6.1.f -- Legitimate interest: connection logging, service security, fraud prevention
• Article 6.1.c -- Legal obligation: retention of billing data (10 years), accounting obligations

Retention periods

In accordance with Article 13.2.a of the GDPR, the retention periods are as follows:

User rights

In accordance with Articles 13 to 21 of the General Data Protection Regulation (GDPR) and the French Data Protection Act, you have the following rights:

Cookies and trackers

In accordance with the ePrivacy Directive (2002/58/EC) as transposed into French law (Art. 82 of the Data Protection Act) and CNIL guidelines, we inform you of the use of cookies on this site.

Strictly necessary cookies: These cookies are essential for the operation of the site (authentication session, language preferences, theme). They do not require your consent.

Analytics and third-party cookies: As of today, GetYourCyber does not use analytics, advertising, or third-party tracker cookies. Should this change, your explicit consent will be obtained beforehand via a compliant cookie banner.

You can manage your cookie preferences at any time through your browser settings.

Subprocessors and recipients

In accordance with Article 13.1.e of the GDPR, the categories of recipients of your data are as follows:

• Hosting provider: cloud infrastructure for hosting the service
• Authentication providers: Google and Microsoft (for SSO, if used by the user)
• Payment service: Stripe (for payment processing, where applicable)
• Emailing service: for sending newsletters and transactional emails
• Anti-bot service: Cloudflare Turnstile (security verification)

Each subprocessor is bound by a Data Processing Agreement (DPA) in accordance with Article 28 of the GDPR.

Data transfers outside the EU

Some subprocessors may process data outside the European Union. In such cases, transfers are governed by:

• Adequacy decisions of the European Commission (Art. 45 GDPR)
• Standard contractual clauses (SCCs) approved by the European Commission (Art. 46.2.c GDPR)

You may obtain a copy of the appropriate safeguards by contacting us at [email protected].

Data breach notification

In accordance with Articles 33 and 34 of the GDPR, in the event of a personal data breach likely to result in a risk to your rights and freedoms:

• The CNIL will be notified within 72 hours of becoming aware of the breach
• Affected users will be informed as soon as possible if the breach is likely to result in a high risk to their rights and freedoms

Data security

We implement appropriate technical and organizational measures to ensure the security and confidentiality of data (Article 32 of the GDPR).

Communications are protected via secure protocols (HTTPS/TLS).

Sensitive data is encrypted or protected by robust authentication mechanisms.